b8d721eea91c3edabf69ba81cd4713cb2f045f64b48a2fbb6dd50eb91aeda18b

Sharing

Copy URL

Twitter E-mail

General

Target

b8d721eea91c3edabf69ba81cd4713cb2f045f64b48a2fbb6dd50eb91aeda18b
Size

843KB
MD5

b773b2d0fcaef1417be81f2e77c1d4fe
SHA1

ae65ac78ef2ef16e6143c41ef0e8573552dca8b1
SHA256

b8d721eea91c3edabf69ba81cd4713cb2f045f64b48a2fbb6dd50eb91aeda18b
SHA512

9d8bc5efc43a55a1db5a8f20f64d5950fa0c599b7d96b169084de13320753489afef5028ffa2d2f51edaa6f9e587abef33e61fc90bbd4f4bc191d8a708fae7ed
SSDEEP

24576:Ux/DiKcsc5mcCyAkVJfj0tQX03RACxHMnMrH:UliKcscWSVVQhAWHMM

Score

N/A

Malware Config

Signatures

Files

b8d721eea91c3edabf69ba81cd4713cb2f045f64b48a2fbb6dd50eb91aeda18b
.exe windows x86

370be6f19aa17d813926cce5831840d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalAlloc
lstrcpy
ReadConsoleInputExW
GetPrivateProfileIntW
EnumCalendarInfoW
LoadResource
ClearCommBreak
GetProcessAffinityMask
GetACP
LoadLibraryA
DeleteFileW
FindFirstVolumeW
CreateEventW
GetConsoleScreenBufferInfo
FindActCtxSectionStringW
PostQueuedCompletionStatus
FormatMessageW
GetProfileStringA
GetTimeFormatW
GetSystemTimeAsFileTime
SetSystemTimeAdjustment
IsValidLocale
FindFirstFileExW
SetProcessPriorityBoost

ifsutil

?GetFirst@TLINK@@QAEPAXXZ
?GetCannedSecurity@IFS_SYSTEM@@SGPAVCANNED_SECURITY@@XZ
?ReverseCopy@INTSTACK@@QAEEPAV1@@Z
?AddVolumeName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?QueryNtfsSupportInfo@DP_DRIVE@@SGJPAXPAE@Z
??1TLINK@@UAE@XZ
?GetData@TLINK@@QAEAAVBIG_INT@@PAX@Z
?QueryMemberCount@TLINK@@QBEGXZ
??1MOUNT_POINT_MAP@@UAE@XZ
??1SECRUN@@UAE@XZ
?SendSonyMSModeSenseCmd@DP_DRIVE@@QAEEPAUSONY_MS_MODE_SENSE_DATA@@@Z

wintrust

WTHelperCheckCertUsage
WVTAsn1SpcMinimalCriteriaInfoDecode
WVTAsn1SpcMinimalCriteriaInfoEncode
mssip32DllUnregisterServer
TrustDecode
CryptSIPPutSignedDataMsg
WTHelperCertFindIssuerCertificate
WTHelperGetProvCertFromChain
CryptCATAdminReleaseCatalogContext
CryptCATVerifyMember
CryptCATGetAttrInfo
WTHelperGetProvPrivateDataFromChain
HTTPSCertificateTrust
WVTAsn1SpcSigInfoDecode

atmlib

ATMRemoveFontW
ATMXYShowText
ATMGetFontInfo
ATMEnumFontsW
ATMFontSelected
ATMGetNtmFieldsA
ATMAddFontEx

Sections

.text
Size: 433KB - Virtual size: 433KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 196KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

370be6f19aa17d813926cce5831840d4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ifsutil

wintrust

atmlib

Sections

.text Size: 433KB - Virtual size: 433KB

.rdata Size: 97KB - Virtual size: 96KB

.data Size: 196KB - Virtual size: 1.5MB

.rsrc Size: 114KB - Virtual size: 114KB

.reloc Size: 1024B - Virtual size: 1004B

.text
Size: 433KB - Virtual size: 433KB

.rdata
Size: 97KB - Virtual size: 96KB

.data
Size: 196KB - Virtual size: 1.5MB

.rsrc
Size: 114KB - Virtual size: 114KB

.reloc
Size: 1024B - Virtual size: 1004B